Thursday 24 April 2008 09.01 EDT
First published on Thursday 24 April 2008 09.01 EDT

The Foundation for Information Policy Research (FIPR) has called on the Home Office to withdraw its "misleading" advice about the legality of Phorm's server-side adware system, in an open letter to Jacqui Smith, the minister in charge there.

The open letter (PDF) follows analysis by Richard Clayton, FIPR's treasurer (and a security expert at Cambridge University) and by Nicholas Bohm, its general counsel. They conclude that "the operation of Phorm's systems involves:

interception of communications, an offence contrary to section 1 of the Regulation of Investigatory Powers Act 2000

users whose ISPs deploy Phorm will end up with tracking cookies stored on their machine, one for every website they visit, but with each containing an identical copy of their unique Phorm tracking number.

Next:

The Phorm system strips out these cookies when it can, but the website can access them anyway, either by using some straightforward JavaScript to read their value and POST it back, or by the simple expedient of embedding an https image within their page. The Phorm system will not be able to remove the cookie from an encrypted image request.

Once the website has obtained the Phorm cookie value, then in countries outside the European Union where such things are allowed (almost expected!), the unique tracking number can be combined with any other information the website holds about its visitor, and sold to the highest bidder, who can collate this data with anything else they know about the holder of the tracking number.

But surely sites know about you already?

Of course, the website can do this already with any signup information that has been provided, but the only global tracking identifier it has is the visiting IP address, and most consumer ISPs give users new IP addresses every few hours or few days. In contrast, the Phorm tracking number will last until the user decides to delete all their cookies…

It's got to be said it's not looking too promising just at the moment. Wonder when BT is going to be starting its trials of the latest Phorm systems? Opt-in, of course..